dpif-netdev: Free packets on TUNNEL_PUSH if should_steal.

Unconditional return may cause packet leak in case of 'should_steal == true'. Additionally, removed redundant checking for depth level. CC: Sugesh Chandran <[email protected]> Fixes: 7c12dfc ("tunneling: Avoid datapath-recirc by combining recirc actions at xlate.") Signed-off-by: Ilya Maximets <[email protected]> Signed-off-by: Ian Stokess <[email protected]>
marbindrakon · May 25, 2018 · 47e1b3b · 47e1b3b
1 parent 7bbc2e1
commit 47e1b3b
Showing 1 changed file with 9 additions and 5 deletions.
diff --git a/lib/dpif-netdev.c b/lib/dpif-netdev.c
@@ -5674,12 +5674,16 @@ dp_execute_cb(void *aux_, struct dp_packet_batch *packets_,
         break;
 
     case OVS_ACTION_ATTR_TUNNEL_PUSH:
-        if (*depth < MAX_RECIRC_DEPTH) {
-            dp_packet_batch_apply_cutlen(packets_);
-            push_tnl_action(pmd, a, packets_);
-            return;
+        if (should_steal) {
+            /* We're requested to push tunnel header, but also we need to take
+             * the ownership of these packets. Thus, we can avoid performing
+             * the action, because the caller will not use the result anyway.
+             * Just break to free the batch. */
+            break;
         }
-        break;
+        dp_packet_batch_apply_cutlen(packets_);
+        push_tnl_action(pmd, a, packets_);
+        return;
 
     case OVS_ACTION_ATTR_TUNNEL_POP:
         if (*depth < MAX_RECIRC_DEPTH) {